UK's proposed alt.GDPR will turn Britain into a 'test lab' for data harvesting
- Reference: 1688640311
- News link: https://www.theregister.co.uk/2023/07/06/uk_data_protection_bill/
- Source link:
The Data Protection and Digital Information ( [1]DPDI ) Bill, proposed last year then amended and [2]re-introduced to Parliament on March 8 is billed by the UK government as a local version of the EU's General Data Protection Regulation, but which applies more common sense and requires less paperwork.
The bill has already [3]met with resistance due to the inclusion of language that does away with the [4]Office of the Biometrics Commissioner and rules on the use of surveillance cameras.
[5]
The draft legislation, according to 28 civil society organizations, would turn the UK into a "leaky valve" that would undermine the data protection rights of European citizens.
[6]Meta's data-hungry Threads skips over EU but lands in Britain
[7]UK's GDPR replacement could wipe out oversight of live facial recognition
[8]UK government set to extract hospital data to Palantir system without patient consent
[9]Brexit dividend? 'Newly independent' UK will be world's 'data hub', claims digital minister
"If passed, the Bill would mean a [10]wholesale deregulation of the UK data protection framework , allowing private companies to seek shelter in the UK to circumvent European data protection standards, and turning the UK into a 'test lab' for experimental and abusive uses of data," the groups said in [11]an open letter to European lawmakers published Tuesday.
Double trouble
Another proposed UK law has come in for similar criticism. The UK Online Safety Bill, which [12]effectively disallows end-to-end encryption , last week got [13]an earful from Apple , which opposes the bill. And over the weekend, a group of almost 70 academics involved in computer security and privacy published [14]an open letter [PDF] voicing similar concerns.
In [15]a statement , Mariano delli Santi, legal and policy officer for Open Rights Group, said the DPDI, if adopted, will damage privacy protections for UK citizens and Europeans and risks jeopardizing the [16]2021 adequacy decision that allows personal data to flow between the EU and UK.
The adequacy decision is based on the UK offering data protection that's more or less equivalent to the EU's GDPR. The groups, including Amnesty International, Open Rights Group, Privacy International, and many others, contend that DPDI will be significantly less protective.
[17]
[18]
The DPDI, they claim, would give the UK government [19]new powers [PDF] to override data protection principles by changing the law – with perfunctory scrutiny – after it becomes an Act of Parliament, through a legislative provision known as a [20]Henry VIII clause [PDF].
US vendor accused of violating GDPR by reputation-scoring EU citizens [21]READ MORE
It would authorize the UK government to issue political directions to the UK data protection body, the Information Commissioner’s Office, the groups say. And it would enable the sharing of European personal data to other countries with reduced protections.
The UK, the groups observe, has already applied to join the US-backed [22]Cross-Border Privacy Rules Declaration , which allows international data transfers under the [23]arguably weak Asia-Pacific Economic Cooperation (APEC) Privacy Framework.
"The Commission must urgently take stock of these changes, which directly contradict key elements of data protection adequacy as defined in article 45(2) of Regulation (EU) 2016/679, and provide European citizens with assurance that it would repeal the adequacy decision if these proposals were to become law," the groups said. ®
Get our [24]Tech Resources
[1] https://www.gov.uk/government/publications/data-protection-and-digital-information-bill-impact-assessments/data-protection-and-digital-information-no-2-bill-european-convention-on-human-rights-memorandum#summary-of-the-bill
[2] https://www.gov.uk/government/news/british-businesses-to-save-billions-under-new-uk-version-of-gdpr
[3] https://www.theregister.com/2023/05/19/dpib_2_surveillance_oversight/
[4] https://www.gov.uk/government/organisations/biometrics-commissioner
[5] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_onprem/personaltech&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2ZKblH@A9UKt1AOsBa9DWtwAAAIM&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0
[6] https://www.theregister.com/2023/07/05/threads_comes_to_uk/
[7] https://www.theregister.com/2023/05/19/dpib_2_surveillance_oversight/
[8] https://www.theregister.com/2022/11/04/uk_governement_set_to_extract/
[9] https://www.theregister.com/2022/10/06/new_dcms_head_newly_independent/
[10] https://www.openrightsgroup.org/publications/policy-briefing-data-protection-and-digital-information-no-2-bill-second-reading/
[11] https://peoplevsbig.tech/open-letter-to-the-eu-commission-regarding-uk-s-data-bill
[12] https://www.theregister.com/2023/03/13/column/
[13] https://www.theregister.com/2023/06/29/apple_online_safety_bill_opposition/
[14] https://haddadi.github.io/UKOSBOpenletter.pdf
[15] https://www.openrightsgroup.org/press-releases/uk-data-protection-reform-experts-and-civil-society-organisations-warn-european-commission-of-threat-to-adequacy-agreement/
[16] https://ec.europa.eu/commission/presscorner/detail/en/ip_21_3183
[17] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_onprem/personaltech&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44ZKblH@A9UKt1AOsBa9DWtwAAAIM&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[18] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_onprem/personaltech&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33ZKblH@A9UKt1AOsBa9DWtwAAAIM&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[19] https://publications.parliament.uk/pa/bills/cbill/58-03/0265/delpowersmemo.pdf
[20] https://publiclawproject.org.uk/content/uploads/data/resources/220/WHY-HENRY-VIII-CLAUSES-SHOULD-BE-CONSIGNED-TO-THE-DUSTBIN-OF-HISTORY.pdf
[21] https://www.theregister.com/2023/06/23/telesign_gdpr_complaint/
[22] https://www.commerce.gov/global-cross-border-privacy-rules-declaration
[23] https://papers.ssrn.com/sol3/papers.cfm?abstract_id=2022907
[24] https://whitepapers.theregister.com/
@Doctor Syntax
"Brexit was always obviously a matter of removing citizens' rights"
Participation in the EU was obviously a matter of removing citizens' rights. Same applies for pretty much the rest of the comment. Guess its a matter of perspective.
Re: @Doctor Syntax
"Brexit has failed."
As described by [Checks Notes] a Mr Nigel Farage.
Re: @Doctor Syntax
Brexit has failed? So has his bank account... according to him, anyway.
(I notice how Lawrence Fox wanted to close his accounts with Barclays because of that, even though Farage's account wasn't with Barclays. GB News... they wouldn't be the sharpest things in the drawer even if they were the only knife in a collection of spoons).
Re: @Doctor Syntax
they wouldn't be the sharpest things in the drawer even if they were the only knife in a collection of spoons
I am so stealing that for future use.
Re: @Doctor Syntax
"Participation in the EU was obviously a matter of removing citizens' rights."
What rights were removed? Which ones? What can EU citizens not do that suddenly "free" UK ones can?
Weird perspective
We are always making choices over who controls our rights - and despite the views of some moral absolutists, it's always a compromise.
It's completely false logic that somehow one set of beuracrats are magically benign, and another evil. These days they're largely all captured by lobbyists and vested interests. The largest poilitical driver for GDPR was about trying to reduce the commercial dominance of American companies, not handing more rights to citizens.
Whether we're in or out of the EU (boring subject), the discussion should be about both rights and the consequences and complexities of enforcement - not a silly pretence that an individual group "knows best".
Re: Weird perspective
"Whether we're in or out of the EU (boring subject)"
Only boring if (a) it has no consequences either way or (b) it has bad consequences which it would be embarrassing to have to discuss.
the deliberately misleading* slogan of taking back control.
That hasn't stopped arch-EU proponent and anti-Brexit negotiator Donald Tusk from borrowing it for his Polish presidential campaign!
Yay - yet more laws
So… US laws, EU laws and now UK laws?
This needs to be harmonized, not fragmented. It’s confusing and expensive for everyone (except lawyers)
Re: Yay - yet more laws
Harmonizing EU and US data laws? 1998 called, admires your optimism and thinks it might just have a way around this mess....
25 years later and 4 workarounds that have been dismissed by European courts (correctly - it's difficult to dispute their arguments) as unsatisfactory, here we are with neither party prepared or likely to move and yet somehow, multinational business must go on.
I'm ignoring the UK because the best they can do in this is choose a side.
Re: Yay - yet more laws
"except lawyers"?
Hmm, well now, isn't it interesting that a lot of MPs studied and practiced law before they became politicians? Could it be that all this red tape could make a lot of friends still in the law biz will make a ton of money with cross border business contracts?
Nah, perish the thought!
Re: Yay - yet more laws
Some of them, maybe, but you're [1]more likely to find ones with an [2]otherwise useless PPE degree , which tends to go hand-in-hand with former membership of the Bullingdon Club, and a school career at Harrow or Eton.
I'd say that having a Law degree goes some way towards proving the intelligence of the holder, but then there's Suella Braverman.
[1] https://en.wikipedia.org/wiki/List_of_University_of_Oxford_people_with_PPE_degrees#UK_politicians
[2] https://www.ox.ac.uk/admissions/undergraduate/courses/course-listing/philosophy-politics-and-economics
What a strange letter:
"In light of the serious threat to European citizens’ rights, the European Commission ... "
The EC is about the EU, and thus EU citizens. Not about "European" citizens, like UK and Belarus.
A letter to EC should just say: "If the UK continues with this, please revoke the equivalance, to protect EU citizens".
The EC is about the EU, and thus EU citizens. Not about "European" citizens, like UK and Belarus.
All your country are belong to us.
I find this quibbling about terminology rather strange. A lot of arguing over someone using the word "Europe" when they mean "The EU", even though we all know what they meant. There are a lot of terms in English where we could use a strict definition that few others are using despite everyone knowing what was meant, but it's rarely helpful. For example, people or things are sometimes characterized as British, meaning they're from or in the UK. However, technically British means from Britain, so if they're Northern Irish or from one of the non-Britain UK islands, I could argue that they're not really British. It wouldn't help anyone if I did that, because we know that is included.
In this case, the terms are even harder, because what the sentence really should say is "In light of the serious threat to the rights of those who have them under GDPR". Noncitizens resident in the EU have those rights as well. Citizens of Iceland, Liechtenstein, and Norway are also covered because they've adopted it, even though they're only EEA, not EU, members. Turkey and Switzerland have laws that are similar to GDPR in an effort to be harmonized with EU regulations, so they might have rights or might not. And, if we're going even further, there are threats to the rights of British, sorry UK citizens, even though the EU commission has no power or intent to do anything about those threats, they're still there if the law is weakened. When you read a statement, do you want a paragraph listing all these technicalities, or can we agree to accept text when we all understand what they meant?
Subject Rights?
Will us UK people still have the rights to a Subject Access Request and to have incorrect data on us corrected as the current UK GDPR allows? I ask because when I was being pestered with utility company bills for someone else the only thing that worked was to send them a formal letter requiring them to remove my personal data (my name and address) from the account as their continued wrongful processing of it was causing me distress, and any failure of them to do so would result in a formal complaint to the ICO. Previous requests and their assurances had failed, so the GDPR and the ICO were my last resort.
Re: Subject Rights?
Good question - and I like the way you used it to get them off your back!
Re: Subject Rights?
IANAL (and the law is yet to be finalised), but...
Under the GDPR legislation, a data controller could refuse or charge for an SAR that was "manifestly unfounded or excessive". The new wording is "vexatious or excessive".
So, it would presumably depend on whether the utility company thought you were being snarky.
Re: Subject Rights?
failure of them to do so would result in a formal complaint to the ICO.
I'll bet that had them quaking in their boots. A smack on the corporate wrist and fined 20 minutes profit?
Re: Subject Rights?
Profit, after taxes and shareholder dividends, minus IP licensing costs to the overseas parent holding company in the Bahamas. Rounded up, that's nought pounds and noughty-nought pence, please.
Can it just be delayed?
There is a good possibility that "this lot" will be out on their ears and we get some grown-ups in instead.
Otherwise, they will just have to infuriate the tabloids by replacing yet another piece of faulty legislation with a word-for-word copy of what was there before.
If they shuffle it off to some committees, it can keep us safe for now.
Re: Can it just be delayed?
There is a good possibility that "this lot" will be out on their ears and we get some grown-ups in instead.
Old 60s saying: it doesn't matter who you vote for, it's always the government in power.
Mass surveillance, like ID cards, is an obsession of the Home Office and both crop up regularly no matter what party is nominally in control. Home Secretaries go native in about 12 months, due to a Civil Service brain washing regime of "this will reduce the crime figures, it would be a brave decision refusing to take the opportunity to catch criminals/drug dealers/terrorists/paedophiles". The only way to stop it would be to disband the existing Home Office hierarchy and move the top mandarins to posts dealing with areas like Northern Ireland community relations or hands on DEFRA inspection of fish gutting operations as punishment for being the enemy within.
This is never going to happen so expect proposed legislation for mass surveillance and/or ID cards to crop up again and again. Democracy needs to win every time, the bastards only need to win once.
get some grown-ups in instead You sure about that?
turning the UK into a 'test lab' for experimental and abusive uses of data
Data = Money is the thinking behind this. Therefore, if you let companies get richer by feasting on personal data, the hope is that they'll move here to harvest it. However, the UK will have to then become an offshore processing centre for data on US citizens and countries with similarly weak privacy protections. Similar to tax havens, we'll become a data haven.
The big gamble is yet again that by shutting the door to EU business (which this will guarantee), the rest of the world will make up for it. But that's a lot of business to lose, and ditching all your customers in the hope of acquiring a completely new set of them is, to put it mildly, one hell of a risky business strategy, that's going to take a long time to pay off, even if it works.
And frankly, the world does not seem to be moving in the direction of loving the free for all of mass data harvesting by corporations : people are waking up to the abuses that this lack of privacy enables, and wanting something done about it. See California's current attempt to clamp down on them for example. With each dumb move like this, Britain maroons itself in bad ideas that already look out of date as the world changes.
Re: turning the UK into a 'test lab' for experimental and abusive uses of data
"the hope is that they'll move here to harvest it."
A vain hope if ever there was one.
Re: turning the UK into a 'test lab' for experimental and abusive uses of data
Given that South Africa has a more permissive regime than this - and has had for years - perhaps studying how well it works there might just be an easier way to go on?
It would be amusing to see the USA to stop data flow because it considers the UK doesn't have adequate protection, though I don't think that'll happen for a few years yet.
Meh, this bill is bollocks as anyone who wants to do business with the EU will still have to meet the requirements of the EU GDPR.
So, do you have a 2 tiered system within your business or just crack on as before?
Then you have all the scumbags flogging your data- cheers gov for screwing us again.
"as anyone who wants to do business with the EU will still have to meet the requirements of the EU GDPR"
And the easiest way of doing that will be by moving to the EU.
Yet..
Yet you're still here, despite your many posts in favour of the EU - why could that be?
Re: Yet..
I'm retired. I no longer run a business. However if I were running a business I might have had to reconsider location. And if I were an employee of a business that depended on trade with the EU and relied on an adequacy situation I'd be very worried indeed. I'm old enough that I can probably see out my time here without too much personal inconvenience.
My children and grandchildren have dual citizenship (as will have any future great grandchildren) so they have a degree of flexibility.
Freedom
The "Freedoms" and "control" we gained by leaving the EU were carefully never specified. Instead there were a bunch of shibboleths; control of our borders,straight cucumbers and of course freedom to save a few paltry million in contributions by paying considerably more in lost opportunities, border controls and so forth.
Re: Freedom
But you have happier fish now! ..?
Re: Freedom
Manx fishermen are happy, they got their quota back!
Re: Freedom
They bought back the quotas that they previously sold off?
Do they have someone to sell their fish to now?
-just interested
Re: Freedom
By happy, I assume you mean dead?
https://www.bbc.co.uk/news/uk-politics-64242217
Re: Freedom
https://youtu.be/OlcilAUNNVQ (Daily fail, also available from guardian)
Re: Freedom
Don't forget the blue passports that we could have had anyway!
Wot could possibly go wrong?
If the forthcoming Digital Rights Act is any measure, this will be a total cluster flock of epic proportions.
There's zero reason to step out of a mutually beneficial data privacy law.
Utter fuckwittery
Re: Wot could possibly go wrong?
Based on past evidence, by an interested outsider, any Data Act will be a green light for local vested interests to feast. Industries and actual protections for proles be damned. So long as the rich get richer. The only tiny upside is that they will be LOCAL and not outside vested interests.
Sadly, unless it is a GDPR, from the real EU, it is only Data Harvesting light and cannot use the name GDPR.
That seems to be what has happened in other jurisdictions that have so-called *Data Protection" legislations.
Thomas Claburn.....You Need Some Help!!!
Title: UK's proposed alt.GDPR will turn Britain into a 'test lab' for data harvesting
It ALWAYS WAS a centre for "data harvesting"...............
GDPR was always A JOKE!!
(1) Absolutely no enforcement
(2) And stuff like this:
- https://www.theguardian.com/uk-news/2018/sep/13/gchq-data-collection-violated-human-rights-strasbourg-court-rules
- https://www.theguardian.com/technology/2017/jul/03/google-deepmind-16m-patient-royal-free-deal-data-protection-act
Please Thomas......get some help!!!!!!!!!!
Re: Thomas Claburn.....You Need Some Help!!!
Without GPDR you wouldn't know what Google or GCHQ were doing.
According to the Computer Weekly article the adequacy agreement also covers law enforcement data. I wonder what the consequences of losing that will be.
Brexit was always obviously a matter of removing citizens' rights wrapped up in jingoism and the deliberately misleading* slogan of taking back control. There's not the least surprise in all this going on. It may benefit a few big businesses in the short to medium term. In the long term it will be more and more difficult for them to squeeze profits from the UK.
* In case you still believed that was to benefit you, take a moment to think who it was who was going to get - and has now got - control and what that control achieved. It wasn't and isn't you and it was to provide protection for the individual.